As demonstrated in [1]}, when a backdoor is embedded by adding trigger set samples into each batch, the backdoor is a strong backdoor. A model containing a strong backdoor means that this backdoor, and therefore the watermark, cannot be removed by an algorithm without a striking decline of the primitive functionality. As presented in Section REF , the backdoor we embed in our scheme is a strong backdoor which means our scheme satisfies the robustness requirement.
